221–230 of 270 posts
Like it might make all their tries of cookie/tracking alternatives meaningless.
I was at Mozilla when this was implemented. It was completely optional for websites to support this. A few did at first. A lot of people internally wanted it to be on-by-default, but the argument was that if it was, nobody would respect it – after all, what tracking platform would willingly only track the 0.1% of people who went into the settings to enable it? (Internet Explorer did eventually enable it by default, w…
>I would love if the cookie modals on each site became browser-level, if the EU regulators who wrote the cookie law had any competence, this is how it would have been implemented. browsers should have a cookie prompt in the UI, not websites.
A browser feature to control cookies wouldn't cover everything the law does.
Earlier quoted context omitted.
> most stabbings are not done by malicious actors, they are simply law-abiding companies which will gladly stop stabbing you if you ask. > The header has only one form, Do-Not-Stab: 1. This is because the lack of a header indicates a clear preference that the user wants to be stabbed. > Exceptions to the Do-Not-Stab header are accepted when commercial interests outweigh safety concerns. These include: Stabbings reque…
I had been on the fence about turning this on or not since I wasn't sure if turning it on would block legitimate reasons for stabbing me. I mean, I probably have deserved it many times. Good to know those reasons won't be blockers! I'll definitely turn this on if it becomes a ratified standard!
Happily, our local police department is sunsetting it, since it gives people a false impression of whether or not they’re currently being stabbed.
Earlier quoted context omitted.
I worked at one of the big adtech companies at the time. DNT was a carefully negotiated compromise between the ad industry (and by proxy, the sites that depended on it for their income), the browser vendors, and privacy advocates. We implemented DNT it in our edge infrastructure and were ready to deploy it. But then Microsoft broke the agreement by enabling it by default, as part of their war with Google (and after t…
>at the time it was essential to the commercial web. The same could be said about slavery.
https://calmatters.org/politics/elections/2024/11/california...
It doesn’t mean either statement is true though.
Browsers need a "keep my cookies" button next to the url bar, separate cookie jar per domain, and then by default, delete all the cookies when you close the window. No EU cookie prompts would be needed, no "this feature does not work without third party cookies, no DNT, no nothing... silently accept all the cookies, and then delete them. (and other persistent storage too). Want to stay logged in? Press the "keep the…
The EU does not require the use of "cookie prompts".
User consent is required to process a user's data for certain purposes+.
That may involve the use of a cookie, or it may not.
Whatever technological methods you use to process the user's data, and regardless of whether it happens on the client or server, you must ask for consent.
Having a system where cookies are not remembered between sessions would be no use, as the user's consent would still be needed while those cookies were set.
+Not everything needs consent, but things like tracking for advertising or analytics typically does. Even if you do it via IP address or local storage, you need to ask for consent - nothing to do with cookies.
One of the basic tenants of contract law is “last writer wins”. If I say “here’s a contract”, and then you make amendments to it, sign it, and then I sign it, the amendments are part of the contract.
It is legally obvious that “Do Not Track” should be incorporated into the user agreement for the web site.
Earlier quoted context omitted.
Get yourself firefox mobile and have ublock origin on your phone :)
I already do, but that only blocks ads in Firefox. If I open a link in an app, it often uses some browser widget that's effectively Chrome.
I was at Mozilla when this was implemented. It was completely optional for websites to support this. A few did at first. A lot of people internally wanted it to be on-by-default, but the argument was that if it was, nobody would respect it – after all, what tracking platform would willingly only track the 0.1% of people who went into the settings to enable it? (Internet Explorer did eventually enable it by default, w…
> IE did enable it by default, which got them good press but ultimately killed the feature since everyone stopped respecting it. That's why RFC 35140 "Do-Not-Stab" specifies that the user agent MUST NOT enable it by default. https://www.5snb.club/posts/2023/do-not-stab/
Earlier quoted context omitted.
> Removing this feature harms user agency It doesn't, because nobody respects it. It is actually harmful to have a feature that misrepresents its efficiency to users, especially when it comes to privacy and security. Nobody should ever feel that they will not be tracked because they enabled do-not-track, because it's wrong. Removing it is the right thing to do because of this.
Counter: It does, because some organizations and webmasters did respect it. The other option, Mozilla should have done, is shame companies that did not respect it. A continually updated list, a notification when browsing a site that did not, etc, but the problem comes from this being a vendor issue and that it would not be 100% accurate. Shaming is the only way this would have worked out, but they didn't, but for the…
~ genuinely curious about statics on the subject.
Earlier quoted context omitted.
You'd be surprised at how many websites work just fine with JS disabled, at least in terms of providing the content you want. Menus/navigation might not work, and I wouldn't even attempt online shopping without JS, but enough websites still manage to display basic text and images without JS that it's a surprising annoyance when they fail to. Sticking out like a sore thumb isn't a problem as long as you look like a di…
I get by using no-script universally and it's rare that I need to allow JS for more than 2-3 domains to get a site fully functional. Usually it's limited to site, and site-cdn.